Last Logon Report Isn't Accurate

Reporting
1

Hi there,

I have set a scheduled last logon report for every 2 days. When I look into one of them, then i see clients whose last login date is older than 3 months and I wanted to check if those clients are really not logged in for 3 months but its not true. Most of those clients are currently online and customers usually logs in every morning.
Need help about it.

2

Last logon for who and to what?

What is the source of your data?

3

Forgive me please but I definitely have no idea about the source of this data. Can you guide me please how can I check its source?

4

From the BigFix Console, select the Tools menu, and choose ā€œManage Propertiesā€. Search through the list (you can start typing the property name) and make note of which Analysis the property you are concerned about is coming from.

Iā€™m not familiar with a default ā€œLast Logonā€ property. There is the ā€œLast Report Timeā€ property. Is that what you are concerned about?

5

Hey Tim!
Iā€™ve just checked the section you have mentioned above but I havent seen anything belongs to my report.
My report called ā€œLast Logon Reportā€ and it gives me clientsā€™ the latest logins with username-hostname-date as output but it doesnt feel right. Maybe its a custom report which is created by previous sysadmin.
Iā€™m really so much beginner on bigfix. All I want to do is checking last logins into computers. I want to know when is a computer used for last time.

6

Is this a Windows/AD environment?

If so, I donā€™t have a good answer, because if you direct a query for a given user to each DC in the domain youā€™ll get a different answer.
AD doesnā€™t regard the last logon as an important piece of information, so it doesnā€™t get replicated with any degree of urgency (unlike information with is an attribute of the user, rather than an effect of the use of that user).

7

Depends which o/s this is on.
If linux when you check is this something that you see them logged in, or if you type ā€˜last usernameā€™ also see history there?
linux user logins may not be captured if logins arenā€™t saved on local server just shipped to remote syslog.
AIX has properties you can query the user account.
linux authenticating to AD also could give unexpected results, depending if you want last login anywhere, or on that server.

1 Like
8

Yes itā€™s Windows under AD environment. Just like youā€™ve said every one of 3 DCs gives different resultā€¦